CyberWire Daily - Farewell to Jean Sammet, co-developer of COBOL. Remembering Midway. NSA leak investigation. Signs of Russian disinformation in the Gulf. Data breaches, script kiddies, EternalBlue, and Turla.

Episode Date: June 7, 2017

In today's podcast, we say farewell to a legendary coder, and we also remember the Battle of Midway. Influence operations in the Gulf may have been Russian. Alleged leak of NSA report on election hacking proceeds. Two new data breaches are disclosed. A script kiddy is arrested in Japan for writing and distributing ransomware. EternalBlue remains a risk. Johns Hopkins' Joe Carrigan reviews research on cracking mobile device passwords using accelerometers. Eliana Schwartz describes the Cybertech Fairfax conference. Turla resurfaces, and they've new backdoors and everything. But what's their thing with Britney Spears? Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. We say farewell to a legendary coder, and we also remember the Battle of Midway. Influence operations in the Gulf may have been Russian. The alleged leak of an nsa report on election hacking proceeds two new data breaches are disclosed eternal blue remains a risk

turla resurfaces and they've got new back doors and everything but what's their thing with britney spears i'm dave bittner in baltimore with your Cyber Wire summary for Wednesday, June 7, 2017. We'd like to begin today's podcast with two bits of retrospective news. First, farewell to Jean E. Samet, who passed away two weeks ago in Maryland. Ms. Samet was the co-designer of COBOL, the Common Business Oriented Language, the programming language thatented Language, the programming language that brought computing to the business mainstream. The U.S. Department of Defense was a big user of COBOL, and COBOL's daughter, Takbal, was

important in early U.S. battle management computation systems like TACFIRE. She passed away on May 20th in Maryland at the age of 89. Our condolences to friends and family, as we remember a long life and a life well lived. Today is also the 75th anniversary of the final day of the Battle of Midway. The U.S. Navy's victory was enabled by creative and brilliant intelligence work done for an admiral, Chester Nimitz, who knew how to use it.

The intelligence story has it all. Brilliant misfits. Navy bandsmen turned codebreakers, even behavioral biometrics. The Morse code operators' distinctive fist on the key and trolling. A message sent to be intercepted by the Imperial Navy and trick Yamamoto's operators into revealing the meaning of their code within a code. So spare a thought for Station hypo and sync pack intelligence, and for Joe Rochefort and Jasper Holmes,

both of whom would have been completely at home in cyberspace. If you want to learn more, Walter Lord's book Incredible Victory is still a great place to start. Turning from history to news, ISIS has claimed responsibility for two more atrocities, a murder and hostage standoff in Melbourne, and a double suicide bombing in Tehran. Both are being exploited online for the presumed inspirational value, although there are some early signs of resistance to being inspired.

Deutsche Welle reports widespread revulsion among the UK's Pakistan community in response to last weekend's attacks in London, and a large number of British Muslim clerics are refusing to conduct funeral services for the terrorists killed during their rampage. The Tehran murders are not as anomalous as some would think. Shiite Muslims are little better than crusaders in ISIS's book. Similar intra-Muslim conflict may be playing out in current tensions between Qatar and its Arab neighbors. Those neighbors, especially Saudi Arabia, have long seen Iran as a dangerous rival in the region. CNN has reported today that U.S. investigators think the news in Qatar

that prompted the diplomatic rift between Qatar and other states in the region was hoaxed. The hackers hijacked Qatar's news service with pro-Iranian commentary and pro-Israeli commentary with the evident intent of inducing just such a response from Saudi Arabia and other Sunni powers. Investigation into the recently charged NSA leaker continues. Reality Winner, the alleged leaker, is reported to have served in the U.S. Air Force as a cryptologic language analyst, working to translate intercepts in languages including Pashto and Farsi. Investigators found her on the basis of internal printer watermarks in the leaked documents, which they saw when the intercept sought to verify that they were genuine.

Edward Snowden, who knows a thing or two about leaking, but who also hardly counts as a disinterested observer, has said that Ms. Winner's prosecution would be a direct assault on freedom of the press, since it involves charging her with providing information to journalists, which we suppose is one way of looking at it. The Intercept is coming in for some criticism of its own, having apparently blown its source by showing a copy of the leaked documents to U.S. intelligence community officials. As far as the leaked reports themselves go, they relate to Russian influence operations conducted up to the final week of last year's U.S. elections. Former U.S. Homeland Security Secretary Johnson says he knows nothing of the report or its

conclusions. The Cyber Wire is proud to be a media partner with the upcoming CyberTech Fairfax Conference, June 13th in Fairfax, Virginia. Eliana Schwartz is one of the organizers of the event, and she joins us with the details. CyberTech Fairfax, which is coming up very quickly next week, is a one-day conference and exhibition about cybersecurity and cyber technology problems and solutions. And we'll have a conference all day. It'll be starting at around 8.30. Doors will open at 7.30, and it'll be until 5.30 p.m. And alongside this, we'll have the exhibition.

And the exhibition will feature approximately 30 companies, and that's including both larger companies and as well as our startup pavilion. And some of the highlights among the sessions are our startup pitch competition, and we'll have a keynote speech from the Honorable Michael Chertoff, who is the former Secretary of the U.S. Department of Homeland Security. Who are you targeting here? Who's the ideal person to attend? We have a nice mix between government, industry, and entrepreneurs. We, of course, have some tech experts as well. That's a large part of our industry and entrepreneurs we of course have some tech

experts as well that's a large part of our audience and our community this event in particular more than some of the other cybertech events based on the location has a lot to do with government cyber security and government industry relations in addition to that we have startups and we have students who are welcome to attend our conference as well. The event is held in partnership with the Fairfax County Economic Development Authority. They are sort of our local anchor in this event. We do cybertech events around the world and we always have a local partner that helps us find the breadth of what the local space has to offer. So this one in particular is with Fairfax County Economic Development Authority and the event itself is being held in Tyson's Corner at the Capital One headquarters.

That's Eliana Schwartz from the CyberTech Fairfax Conference. You can find out more about the conference at fairfax.cybertechconference.com. The eternal blue exploits behind WannaCry and some other recent problems are appearing in attempts against aerospace and defense industry targets. They're reported to have been ported to Windows 10, which lends additional urgency to patching. The attention ransomware has recently drawn has tended to eclipse other threats, including the familiar ones of large data breaches. Two such have surfaced this week. Two such have surfaced this week.

Security company 4IQ found 77 million individuals' records exposed in a breach of Edmodo educational technology. And Chrometech researchers found an exposed database in the U.S. of 10 million cars and their owners. Thieves are thought to be popping champagne corks, at least figuratively, over the trove of VIN numbers and associated data. A teenage boy in Japan has been arrested for creating and distributing ransomware. His motive? It wasn't even financial. He wanted to become famous.

The kid is only 14. The Turla threat actors are back, working through a back-doored Firefox extension that checks Instagram for command and control. Platforms other than Instagram are also being used, but Turla shows a preference for Britney Spears' Instagram emissions. Turla's thing for Ms. Spears baffles us. We'd have thought they were, like us, partial to Olga, Rita, and Vera. But go figure.

So this one's for you, all you cryptologic language analysts. We still love you guys. You're all winners, the good kind of winners, in our book. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. Thank you. Do you know the status of your compliance controls right now? Like, right now.

We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting,

and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+.

And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families

24-7, 365 with Black Cloak. Learn more at blackcloak.io. Joining me once again is Joe Kerrigan. He's from the Johns Hopkins University Information Security Institute. Joe, I saw an article come by on TechCrunch about some researchers from Newcastle University in the UK. They published a paper recently that was talking about onboard sensors and privacy issues. that was talking about onboard sensors and privacy issues. Specifically, they were able to crack four-digit pins on people's mobile devices with 70% accuracy on the first try simply by using the accelerometers in the device.

Right, and they know that when you push a certain button, the phone's going to tilt one way. Like if you push a five, the phone's going to go straight down. If you push maybe a two, it's going to bend up a little bit. This is an issue because I know in Android, and I'm not sure about what the level of permission access is in the Apple universe, but in Android, a lot of these permissions, or a lot of these sensors rather, don't require any permissions to access them. Things like the accelerometer, the proximity sensor, the light sensor. The Android model doesn't view this as a threat. The operating system won't ask for you to approve that the app has access to this. Now, they will

ask that you approve the app has access to some of the more obvious sensors, like your microphone on your phone or your camera. Now we're talking about the use of these unprivileged sensors for, you know, and this is what hackers do is they think about how to find the unintended use of this, of whatever is available to them, and they capitalize on it. I think this is pretty smart. These guys at Newcastle came up with a very clever way to deduce some very important information from some unprivileged sensors. And the article points out that they can access this information through a web browser. So, you know, theoretically, you could have some browser tab open in the background. Right. And while that tab is left open in the background, you know, seemingly minding its own

business, no, it can be monitoring this information this information right while you're entering in pins or passwords for other things it can be using just the accelerometer and positioning data from the phone which it didn't have to ask for permission to get exactly to uh to get your passwords and pins with a shockingly high percentage of accuracy but they said it it took five tries or five... 70% accuracy on the first try, 100% accuracy by try number five. Right. That's interesting that it takes that many tries to get 100% accuracy. Yeah, then one of the things

they said was the point here, how to protect yourself against this, is to close tabs in the background. Close tabs in the background, right. Quit apps or make sure they're not running in the background. Or uninstall them. Uninstall them. Well, you know, we've talked about those flashlight apps. Right. Oh, yeah. Free apps that just, you know, require all sorts of permissions. But in this case, they don't even need to ask to get access to this data on your mobile device. Right. Yeah.

One of the things I'm happy to see is a lot of vendors are coming out when you buy a phone from them, the flashlight app is already included in the phone. Yeah, so yet another thing to be mindful about on your mobile device. Thanks to these clever, clever researchers and inevitably the hackers who follow in their footsteps. That's right. All right, Joe Kerrigan, thanks for joining us. My pleasure.

Cyber threats are evolving every second, and staying ahead is more than just a challenge it's a necessity that's why we're thrilled to partner with threat locker a cyber security solution trusted by businesses worldwide threat locker is a full suite of solutions designed to give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable.

That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.